CVE-2025-13313

The CRM Memberships WordPress plugin is vulnerable in versions up to 2.5 due to missing authorization checks on the ntzcrm_changepassword AJAX action and an unauthenticated ntzcrm_get_users endpoint, enabling unauthenticated password resets and enumeration of subscriber emails. This can grant att...

CVE-2025-13313 CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint

The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the ntzcrmchangepassword AJAX action. This makes it possible for unauthenticated attackers...

CVE-2025-13313 CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint

The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the ntzcrmchangepassword AJAX action. This makes it possible for unauthenticated attackers...

EUVD-2025-201340

The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.5. This is due to missing authorization and authentication checks on the ntzcrmchangepassword AJAX action. This makes it possible for unauthenticated attackers...

EUVD-2025-201305

The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account...

PT-2025-49192

Name of the Vulnerable Software and Affected Versions WordPress CRM Memberships plugin versions up to and including 2.5 Description The CRM Memberships plugin for WordPress is susceptible to privilege escalation through a password reset function. The issue stems from a lack of proper authorizatio...

WordPress plugin CRM Memberships 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-66509

LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process ...

CVE-2025-53704

The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account...

CVE-2025-66509

LaraDashboard vulnerability CVE-2025-66509 affects version 2.3.0 and earlier. The password reset flow trusts the Host header, enabling an attacker to redirect the administrator’s reset token to a remote server. When combined with the module installation process, this can trigger ServiceProvider::...

EUVD-2025-201292

LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process ...

CVE-2025-66509 LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain

LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process ...

CVE-2025-66509 LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain

LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process ...

CVE-2025-53704 MAXHUB Pivot Weak Password Recovery Mechanism for Forgotten Password

The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account...

CVE-2025-53704 MAXHUB Pivot Weak Password Recovery Mechanism for Forgotten Password

The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account...

CVE-2024-32642

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6...

MAXHUB Pivot

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to request a password reset and gain unauthorized access to the account. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such...

laradashboard 访问控制错误漏洞

laradashboard is a content management system from Lara Dashboard open source. An access control error vulnerability exists in laradashboard version 2.3.0 and earlier, which stems from the password reset process trusting the Host header, which could result in the reset token being redirected to an...

MAXHUB Pivot client application 授权问题漏洞

The MAXHUB Pivot client application is a client component of a device management platform from MAXHUB Corporation. An authorization issue vulnerability exists in the MAXHUB Pivot client application that stems from a weak password reset mechanism that could lead to account takeover...

PT-2025-49157

Name of the Vulnerable Software and Affected Versions Pivot client application affected versions not specified Description The password reset mechanism is weak and could allow an attacker to take over an account. Recommendations At the moment, there is no information about a newer version that...